Editor’s Note: Cognitive warfare is often written about as a mix of propaganda, deepfakes, and platform manipulation. A new NATO CCDCOE paper from Tallinn, released in 2026, takes the concept in a sharper direction. The authors argue that the real attack is aimed at the shared habits of judgment that let institutions make sense of the world — standards for what is true, rankings of values, a sense of who belongs, trust in institutions, and a shared picture of the future. Attack those layers, and an organization stops thinking together. The paper calls that collapse cognitive decoherence, and it says it often unfolds without anyone noticing.
For cybersecurity, information governance, and eDiscovery professionals, that framing lands directly. Review teams run on shared authentication standards. Records programs run on stable classification schemas. Courts run on provenance chains that may be challenged years later. Proposed Federal Rule of Evidence 707 and the Sept. 9, 2025, Mendones terminating-sanctions ruling show a system already adjusting to AI-generated artifacts — and reviewer trust is the first thing that buckles.
The CCDCOE’s shift from detection-attribution-response to coherence preservation could shape practitioner guidance in the years ahead; it is the part of the paper most likely to travel.
Content Assessment: Invisible by design: NATO’s 2026 cognitive warfare paper and the crisis of discovery
Information - 93%
Insight - 94%
Relevance - 92%
Objectivity - 93%
Authority - 94%
93%
Excellent
A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Invisible by design: NATO’s 2026 cognitive warfare paper and the crisis of discovery."
Industry News – Cybersecurity Beat
Invisible by design: NATO’s 2026 cognitive warfare paper and the crisis of discovery
ComplexDiscovery Staff
A new NATO study warns that the sharpest attacks on a society, a company, or a court case are the ones the target never sees coming — and may never recognize as attacks at all.
The paper, released in 2026 by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, argues that cognitive warfare does not go after what people know. It goes after how they build knowledge in the first place. The target is not the data. It is the shared habits of judgment that let an institution make sense of its world.
The authors treat cognitive warfare as a category distinct from the five NATO-recognized operational domains of land, sea, air, space and cyberspace. Cyber tools may deliver the attack. The target is the meaning-making layer, not the network.
That argument carries practical weight for cybersecurity, information governance, and eDiscovery professionals, because those habits of judgment are exactly what their workflows rely on.
The paper, “Ontological Foundations of Cognitive Warfare,” is written by Fedir Korobeynikov, director of digital technologies and information security at System Capital Management and founder of the Kyiv-based Security Studies and Research Center; Andrii Davydiuk, a branch head at the CCDCOE and deputy branch head at Ukraine’s State Cyber Protection Centre; and Volodymyr Mokhor, director of the G.E. Pukhov Institute for Modelling in Energy Engineering at the National Academy of Sciences of Ukraine.
One author is embedded at the CCDCOE; two hold Ukrainian affiliations. That matters. Cognitive warfare theory is informed by operational experience in Ukraine and by broader NATO concerns about Russian and other state actors’ cognitive operations. Readers should calibrate the paper’s framing with that in mind.
The study lands inside an active NATO publishing cadence. The NATO Chief Scientist’s report on cognitive warfare appeared in 2025. NATO Allied Command Transformation released the fifth installment of its Cognitive Warfare Newsletter in January 2026. The CCDCOE paper extends that conversation rather than opening it. What it adds is a sharper answer to a question prior work left open: what, exactly, is the target?
It also lands inside an active academic debate. In a 2024 Frontiers in Big Data article, researchers Christoph Deppe and Gary S. Schaal of Helmut Schmidt University in Hamburg argued that the NATO ACT cognitive warfare concept suffers from “conceptual stretching” — its boundaries blur with hybrid threats, foreign information manipulation and interference, and traditional information warfare, which makes it hard to operationalize for empirical study. The CCDCOE authors cite that critique directly and position their structure-centric model — the five building blocks, the multiplex architecture, the diagnosable connector nodes — as one answer to it. Whether the model survives the operational test Deppe and Schaal set is the open question; this paper is the strongest current attempt at a reply.
What the paper says is under attack
The authors name five building blocks that hold an organization together. Each one is what the paper calls a systemic invariant — a stable structure that keeps the organization coherent even as other things change.
The first is shared standards for what counts as true (the paper calls these epistemic structures). The second is how the organization ranks values — what it will trade off and what it will not (axiological hierarchies). The third is the sense of who belongs to the group and who does not (identity constructs). The fourth is trust in institutions, leaders, and procedures (architectures of trust). The fifth is a shared picture of the future the organization is working toward (teleological projections).
Cognitive warfare, the paper argues, targets those five layers directly. And because the layers are connected, hitting one can ripple through the others. Erode trust in a source of information, and people start to question the values that source was defending. Fragment identity, and the shared picture of the future splinters too. The paper calls this cascading collapse cognitive decoherence. The institution’s components keep working on their own, but they stop working together. A company in this state might find its finance team and its product team still delivering quarterly reports on schedule, but no longer sharing a working definition of what “customer success” means. Each function operates. The coordinated decision does not.
Why conventional cyber defense does not catch it
The paper draws a sharp line between cognitive attacks and the five domains NATO officially recognizes: land, sea, air, space and cyberspace. Attacks in those five domains leave evidence. Kinetic strikes produce debris. Cyber intrusions eventually surface as alerts, failed systems or missing data.
Cognitive attacks do not. The authors call this property constitutive invisibility, which is their way of saying the attack is invisible by design, not by luck. The person under attack experiences the induced change — new doubts, new values, a new sense of identity — as their own thinking, not as something done to them. There is no moment when the target knows it is at war. The organization that has drifted in this way does not feel drifted. Its leaders still trust the same sources, because trusting them is the habit they have always held. Its teams still rank the same values, because those values are now their own. The attack shows up as conviction, not as an incident.
French analyst François du Cluzel, whose 2020 NATO Innovation Hub report is a foundational text in the field, captured the durational problem in a sentence the CCDCOE paper quotes directly: cognitive warfare is “potentially endless since there can be no peace treaty or surrender for this type of conflict.” The cognitive domain is still a debated candidate to become NATO’s sixth official domain. It has not been recognized yet.
The defensive move the authors want
The conventional defensive loop most cyber teams know runs in three steps: detect the attack, figure out who did it, and respond. That loop, the authors argue, does not work when the attack is invisible and the target does not know it is happening. Defence has to move upstream, to the proactive preservation of coherence among the five building blocks before any of them is compromised. NATO is already calling this posture cognitive resilience.
The authors concede that their model is at an early stage. It is a way of thinking about the problem, not a measurement tool. Indicators for the connections between layers, methods for identifying which institutions and individuals hold those connections together, and metrics for tracking coherence are all work for future research. The paper rests on a synthesis of NATO documents and academic literature, not on primary field study.
Those limits are also an invitation. The CCDCOE authors left the operational application of their framework open. That opening is where the practitioner conversation picks up.
Three new considerations for cyber, IG, and eDiscovery professionals
The CCDCOE paper does not prescribe applications for legal discovery or information governance. What follows is this article’s reading of the research for those sectors—offered as a starting point for practitioners.
The reviewer-trust layer is now a target. A discovery matter runs on shared judgment calls — what counts as authentic, what is privileged, what is relevant, whose expert opinion carries weight. Those judgment calls are themselves the building blocks the paper describes. A cognitive attack on a matter is unlikely to trip a security operations center alert. It arrives as doubt. A review team that used to agree starts to disagree. An expert revises an earlier opinion without a clear reason. The liar’s dividend — a term coined by legal scholars Bobby Chesney and Danielle Citron in 2019, and documented empirically by Loughborough University researchers Cristian Vaccari and Andrew Chadwick in Social Media + Society the following year — walks into the review room. The Sept. 9, 2025, dismissal of Mendones v. Cushman & Wakefield, Inc. by California’s Superior Court of Alameda County, with terminating sanctions issued after the court found plaintiffs had submitted deepfake video and altered-image evidence detected through metadata inconsistencies, is a concrete version of what this looks like.
Provenance is now something to engineer, not something to assume. The shared standards for what counts as authentic evidence are under pressure from AI-generated artifacts. Proposed Federal Rule of Evidence 707, scheduled for a vote by the U.S. Advisory Committee on Evidence Rules on May 7, 2026, would apply expert-reliability standards to machine-generated evidence. The practical move for cyber and eDiscovery practitioners is to treat provenance as something to build, not something to accept on faith. Cryptographic chain-of-custody binds each handoff of a document to a tamper-evident signature, so any later change leaves a visible mark. Content credentials attach origin metadata to a file so that its source, creation time, and edits can be verified after the fact. Direct primary-document fetching pulls evidence from the originating source rather than from a secondary report, which closes the gap where a cognitive attack can substitute a plausible-looking summary for the real thing. For information governance teams, the same logic covers classification schemas, retention policies, and record authenticity chains. A poisoned classification schema can make records invisible to the holds that should trigger on them. A quietly changed retention policy can delete evidence before litigation touches it. Schema-integrity audits confirm the classification layer still matches what it was at record creation. Versioned classification histories let stewards replay how records were classified year by year. Cryptographic anchoring of record provenance lets a future reader prove a record has not been quietly reclassified. Together, these practices defend the invariants before they are attacked.
The defensive surface does not close at the final order. The paper’s durational claim carries an analogy for eDiscovery practice. If cognitive warfare is, as the authors argue, potentially endless, then by extension the idea of matter-close — while outside the paper’s scope — does not map cleanly onto cases this threat touches. Data survives the closure. So does the framing that shaped how the data was produced, reviewed, and interpreted. Cyber, IG, and eDiscovery professionals are defending a duration that keeps running after the judgment is entered.
The practical implication across all three angles is the same one the CCDCOE authors press for NATO defence. Build invariant integrity before matters open. Do not wait for an incident ticket.
How should cybersecurity, information governance, and eDiscovery practitioners redesign authentication and stewardship so they hold up against an attack that may never announce itself?
News Sources
- Korobeynikov, F., Davydiuk, A., & Mokhor, V. (2026). Ontological Foundations of Cognitive Warfare. NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE). Tallinn, Estonia.
- Mendones v. Cushman & Wakefield, No. 23CV027421 (Cal. Super. Ct. Sept. 9, 2025).
- Ontological Foundations of Cognitive Warfare (CCDCOE)
- New CCDCOE research reconceptualises cognitive warfare (CCDCOE)
- Cognitive warfare: Beyond military information support operations (NATO Allied Command Transformation)
- NATO Chief Scientist’s report on cognitive warfare (NATO Science & Technology Organization)
- Cognitive Warfare Newsletter Issue 5, January 2026 (NATO Allied Command Transformation)
- Cognitive warfare (du Cluzel, 2020 Innovation Hub report) (NATO ACT Innovation Hub)
- Deepfakes and Disinformation (Social Media + Society)
- Court Throws Out Case After Finding Plaintiffs Submitted Deepfake Videos and Altered Images (Reason)
- Safeguarding the Courtroom from AI-Generated Evidence: Federal Rule of Evidence 707 (Nelson Mullins)
- Cognitive warfare: a conceptual analysis of the NATO ACT cognitive warfare exploratory concept (Frontiers in Big Data)
Assisted by GAI and LLM Technologies
Additional Reading
- When Your Legal Tech Vendor Gets Breached: DocketWise Incident Exposes 116,666 Immigration Records and a Profession’s Blind Spot
- The DOJ’s Cyber FCA Playbook Is Working as Enforcement Triples and Shows No Signs of Slowing
- FTC’s OkCupid Action Reframes AI Training Data as a Consumer Protection Issue
- White House AI Framework Signals New Compliance Stakes for Legal, Cybersecurity, and eDiscovery
- The Gatekeeper’s Key: How the Conformity Assessment Unlocks the EU AI Market
Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.


























